6 ms·
Yeah it is a bit muddled honestly. I had to read it a couple times and I still don’t completely get what happened: 1. Employee installs a key logger 2. Snowfl
by BillFranklin 2y ago
Yeah it is a bit muddled honestly. I had to read it a couple times and I still don’t completely get what happened:
1. Employee installs a key logger
2. Snowflake does not expire session cookies
3. Malware steals their session cookie and password, so can bypass employee MFA/okta
4. ???
5. Somehow this one employee has admin access to 4000 snowflake instances
- happyopossum 2y agoStep 4 is right in the article: "they were able to sign into a Snowflake employee’s ServiceNow account using stolen credentials, thus bypassing OKTA which is located on lift.snowflake.com. Following the infiltration, the threat actor claims that they were able to generate session tokens, which enabled them to exfiltrate massive amounts of data from the company"
- p0seidon 2y agoYes, but how should ServiceNow create session tokens if it is not part of the SSO system? I don't know enough about ServiceNow, but I think every large company has some products that are not part of their-SSO system. So that makes sense, but I am not sure about the next step.
- pluto_modadic 2y agoI think they mean regenerating servicenow's own tokens/cookies, without hitting okta. so SN's session would still be valid.